hxxps://cdn[.]discordapp[.]com/attachments/1461498648876679351/1536172060353626162/ImGui-Menu-MemeSense-main[.]zip?ex=6a8ae9f7&is=6a899877&hm=3fa06a213856b28e9e8fd60747b849ad4a02fbccc2e4e6ceee8e71fdb457f76d&

Analysis

user interaction
yes
max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/08/2026, 16:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cdn.discordapp.com/attachments/1461498648876679351/1536172060353626162/ImGui-Menu-MemeSense-main.zip?ex=6a8ae9f7&is=6a899877&hm=3fa06a213856b28e9e8fd60747b849ad4a02fbccc2e4e6ceee8e71fdb457f76d&
Sample260822-tkfdtsweja

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
820	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134318884214345376"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{9726FFF6-1921-4B70-A64B-A6DF1F130CC5}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\.sln	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\sln_auto_file\shell\edit	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\sln_auto_file\shell\open\command	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\sln_auto_file\shell\open\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\sln_auto_file\shell	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\sln_auto_file\shell\edit\command	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\sln_auto_file\shell\edit\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\sln_auto_file	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\sln_auto_file\shell\open	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\.sln\ = "sln_auto_file"	OpenWith.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4764	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe

Suspicious use of SetWindowsHookEx 19 IoCs

pid	Process
4764	OpenWith.exe
4764	OpenWith.exe
4764	OpenWith.exe
4764	OpenWith.exe
4764	OpenWith.exe
4764	OpenWith.exe
4764	OpenWith.exe
4764	OpenWith.exe
4764	OpenWith.exe
4764	OpenWith.exe
4764	OpenWith.exe
4764	OpenWith.exe
4764	OpenWith.exe
4764	OpenWith.exe
4764	OpenWith.exe
4764	OpenWith.exe
4764	OpenWith.exe
4764	OpenWith.exe
4764	OpenWith.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 3300 wrote to memory of 5048	3300	msedge.exe	86
PID 3300 wrote to memory of 820	3300	msedge.exe	87
PID 3300 wrote to memory of 1856	3300	msedge.exe	89
PID 3300 wrote to memory of 1856	3300	msedge.exe	89
PID 3300 wrote to memory of 1420	3300	msedge.exe	88
PID 3300 wrote to memory of 1420	3300	msedge.exe	88
PID 3300 wrote to memory of 1420	3300	msedge.exe	88
PID 3300 wrote to memory of 1600	3300	msedge.exe	90
PID 3300 wrote to memory of 2888	3300	msedge.exe	91
PID 3300 wrote to memory of 1600	3300	msedge.exe	90
PID 3300 wrote to memory of 1600	3300	msedge.exe	90
PID 3300 wrote to memory of 2888	3300	msedge.exe	91
PID 3300 wrote to memory of 2888	3300	msedge.exe	91
PID 3300 wrote to memory of 3204	3300	msedge.exe	93
PID 3300 wrote to memory of 3204	3300	msedge.exe	93
PID 3300 wrote to memory of 3204	3300	msedge.exe	93
PID 3300 wrote to memory of 3008	3300	msedge.exe	94
PID 3300 wrote to memory of 3008	3300	msedge.exe	94
PID 3300 wrote to memory of 3008	3300	msedge.exe	94
PID 3300 wrote to memory of 980	3300	msedge.exe	97
PID 3300 wrote to memory of 1528	3300	msedge.exe	98
PID 3300 wrote to memory of 980	3300	msedge.exe	97
PID 3300 wrote to memory of 1528	3300	msedge.exe	98
PID 3300 wrote to memory of 1120	3300	msedge.exe	99
PID 3300 wrote to memory of 1120	3300	msedge.exe	99
PID 3300 wrote to memory of 1476	3300	msedge.exe	100
PID 3300 wrote to memory of 1476	3300	msedge.exe	100
PID 3300 wrote to memory of 1476	3300	msedge.exe	100
PID 3300 wrote to memory of 4768	3300	msedge.exe	101
PID 3300 wrote to memory of 4948	3300	msedge.exe	105
PID 4764 wrote to memory of 4900	4764	OpenWith.exe	125

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/1461498648876679351/1536172060353626162/ImGui-Menu-MemeSense-main.zip?ex=6a8ae9f7&is=6a899877&hm=3fa06a213856b28e9e8fd60747b849ad4a02fbccc2e4e6ceee8e71fdb457f76d&
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffb8e8cc188,0x7ffb8e8cc194,0x7ffb8e8cc1a0
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1928,i,11728929581962725420,1344576193551653276,524288 --field-trial-handle=2324,i,4504034780407157373,11602643847256993422,262144 --variations-seed-version --mojo-platform-channel-handle=2480 /prefetch:3
  2⤵
  - System Time Discovery
  PID:820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1732,i,10064865283310937912,7518208912030985596,262144 --field-trial-handle=2324,i,4504034780407157373,11602643847256993422,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:2
  2⤵
  PID:1420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2348,i,10490982035955196483,17876708955657643342,524288 --field-trial-handle=2324,i,4504034780407157373,11602643847256993422,262144 --variations-seed-version --mojo-platform-channel-handle=2696 /prefetch:8
  2⤵
  PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,6523218311396763621,16251538451693163072,2097152 --field-trial-handle=2324,i,4504034780407157373,11602643847256993422,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:1600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,18192985474370269169,2491023683422467326,2097152 --field-trial-handle=2324,i,4504034780407157373,11602643847256993422,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:2888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4208,i,3489701604866279276,1404670639059636820,2097152 --field-trial-handle=2324,i,4504034780407157373,11602643847256993422,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:1
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4248,i,2712743511976059656,8260031750220732046,2097152 --field-trial-handle=2324,i,4504034780407157373,11602643847256993422,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:2
  2⤵
  PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4940,i,17208231157341275666,12535389285672668917,524288 --field-trial-handle=2324,i,4504034780407157373,11602643847256993422,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  PID:980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4924,i,4159316639741580015,7891504174647055706,524288 --field-trial-handle=2324,i,4504034780407157373,11602643847256993422,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5700,i,16413892102905856128,14867820675851183354,524288 --field-trial-handle=2324,i,4504034780407157373,11602643847256993422,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:8
  2⤵
  PID:1120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5748,i,15778739788908311575,17529926687571299844,2097152 --field-trial-handle=2324,i,4504034780407157373,11602643847256993422,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:1
  2⤵
  PID:1476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3584,i,13782465746584804512,17368535343187095713,524288 --field-trial-handle=2324,i,4504034780407157373,11602643847256993422,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:8
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6504,i,3710393405320341792,9869653859740411963,524288 --field-trial-handle=2324,i,4504034780407157373,11602643847256993422,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:8
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6504,i,3710393405320341792,9869653859740411963,524288 --field-trial-handle=2324,i,4504034780407157373,11602643847256993422,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:8
  2⤵
  PID:4948

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2580

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1160

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4764
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_ImGui-Menu-MemeSense-main.zip\ImGui-Menu-MemeSense-main\MemeSenseFramework.sln
  2⤵
  PID:4900

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 2bc7f3a4024d9673a2f7a098d546fe1f592a8aa0477eb259121fe80954c2f99d
MD5 403039b77d88ae3c8e79a108e60c95e6
SHA1 478b6a90cbd5967be9b36c911b5a2135e0b7199c
SHA512 fbec8c6863e6042041cea05b5efa69ca53b0340f3bee0900ef55602e442dca5b20c736b16589ad755fc44c45bb2c920ed0e29957fb7ab74fe05e101f104c82fb
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7I:fwUQC5VwBIiElEd2K57P7I
TLSH
T1EEB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c940d188ab030b713ca22632d74da3274c2906564b4b03738a468c4c21f8aca0
MD5 31d38895e3328226e32ffe0982bc4bbc
SHA1 a5e3b93cfa8b8f85be97da4f75316f6bdfa484bf
SHA512 c45911bbee8fe9aaf8329deccb43d61fdf7c69193320147838d0091e340733494cfaa7e68016b0f78d1ed1477db2079b2d5e0ff12334a6e579c392541cae4eb4
TLSH
T137D02314BD7CF6D4F163103D55519602714CAB967A135216F150444D5D3755253D05D2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1c8e6fcbb66aba64fe595f222fc4117e00e82ccdc0eef2100a1b4f7babb04f87
MD5 398d1e7948d46a763209c466fdacd0fb
SHA1 b26f2c32bc106089a59ce779d792beaba59f92bf
SHA512 a0bbf31d803e7333d004f03de9c261732d00cceb5d82dd64b5f0decf8adc8b840891187c72bb21cce83873e6d4dd2fab89d4c7efa320afe2ef3589678dcb1424
TLSH
T1B6D080277A196004F3964175A483D7061319956129575711F310C44CA9775D553C11C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5d2c4e39ddbeb0ac61628bae04f1ac5787600ec893b0e230d1a84d61470771a9
MD5 cd6e704306442404371caebfec7f5b29
SHA1 e4beab8b7820af3633bf7c75a5498a958a95832e
SHA512 de66681a9245e8ece7d7e2ea2080251c395f2aeb8a885ac007eaf16f2ee3a3e36610d2afc17be964a038704371cedfbe4da91143ebed5adac20dbda97768d6e6
TLSH
T13AD080273A196404F7964175A483D7061319956129579712F310C44C99775D553C11C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 6ab7fb512489eda8b111de01cd4a38e5ea058eab7fe1f8c96b9449bb65311b05
MD5 f6a3c23ca9566f7e2679a765c7e15ac8
SHA1 c8fddb5649a5604f564604777c25983fde2b1cf3
SHA512 63c3b908d61d177e591756d1ba8f5db1ff86d9c7d8b7e54f28d31868052d40b3159f03a5bb416e16df1481a4d1a3f3dc94ab9ed60281143a5910f7d374cc058b
TLSH
T12B810BB42263A39CC35C42315DD22E3C34B786F9F4079F5B5198DA31EE56711C33A995
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5865ba.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5865ba.TMP
Size 3KB
SHA256 7e23968188a36f66b359ebd3b0e9a1565e496f6965e1dbe6b8a1691061e9cc71
MD5 75f7d43652f419c70001a0ef500dca2c
SHA1 91d2ffc3a701ba26593582135c0314327baa16d5
SHA512 e17c07b93903c9e04feed310e70d4a03c1f5a6c7e736ac7776a3ccae9590d49b24a14b0e9d71b539cd1da8022221c78b66b9ecaf56da576260def12fd97bfcf7
TLSH
T126810AB41263A39CC35C42315DD22E3C34B786F8F4079F4B5198DA31EE52711C23A985
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 7caf08d1e666c38c716bb6cf31bc6f1480b27977fe852adb4a4c08725a95cc49
MD5 ba7f0d6b6565e8430577553774d4ebb8
SHA1 01de0760b19a94caa7c907c272db975dd1a2a91d
SHA512 4775d1d4facc4a6b3c7d4ec69bb2792a2fcc8e48f966d2bf1a65df742a07fd2be17ad103588022cbbeed3112f55f53597a79c0f2736713633c10808de59abec0
TLSH
T16421AAF3C2D5866EC90266F46A14AE1BCE2D0918432D3C1AC9D4EF6BD7E3072E10294F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 d3ef1d68253a01adfb60fa68e2211c0f27779793f739ff8ec2cd56978ea1c6a4
MD5 c39216902d71775eb6c1128a3e103310
SHA1 ea41a1fd31d7efe9f0348092a0fd61f198b9d88e
SHA512 45fa231bb116f1ea93bee15eecea15540fb3b01a773a77e247b4fe0d351a577fb63e7455455752918b8d89e89456b190670bd687e0cdc1840a37d2a08bf6dd12
SSDEEP 192:sxZQRUyM/jK1Ml8q9J/fBsbWpVU5+IdpJHW6+WNGYC6ScOWIgFJ:sxZQa5J/fBsbWvU5vJHbGw7v
TLSH
T1B252D815AA34A97BCCCBD20DFA557F53D6F91433A2910D48A9FCCA1C04E6AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 542047573e7a65ca4b8a5dcfba34d3eae7baeabe7adbff7e1656a08f5f79b335
MD5 2581b3846639528aa73cd462596faa91
SHA1 b77b0d229d89ef1fb68230dd9f2902b1039a7e15
SHA512 404716e8fbc69e1ced8c382fcd9b12c8ac35b864ae2f29e90aa1c2f1cf227f9960eab6c1d2a2affdc71d23ae9199dc9fdf3cb58dcc740fe84e78be56139231b5
SSDEEP 48:KeDQ3jVNNeD9KFI0DeKNrF5ehbOiyJz/yNlI5KOs0byVdIVKWYw6z:KskQKhSSulmKOsi+d+KWYtz
TLSH
T1BC913712307F028238BE391D92A686368E42B597356CA8FF7BB940615E66E111CFCDDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

acc9101b-5a06-4b33-8c09-85ba7bc492e0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\acc9101b-5a06-4b33-8c09-85ba7bc492e0.tmp
Size 30KB
SHA256 8d082a1397068833e24b401fb6f07cb0d1f0e018f1fa235a178481051c42b545
MD5 994e13ee33c1f560e120516d267d256d
SHA1 8035fe3cda0a67613d260c0bc94807198f41044f
SHA512 7e2f64a63c3fa2ed375dd64f661fef0fc5613817f439f8f275a657b60eb22705cc178a0734f1b6ba7e0f8b305b6aa87a7373a55137a8abaa5f5fc8941be1e354
SSDEEP 768:PE8bqn+WvSCt68F1+UoAYDCx9Tuqh0VfUC9xbog/OVnZLlRTKVsro+:PE8bqn+WvSCt6u1jaCZLbWV3+
TLSH
T188D20A3B280CCB7E4F845E5CDC26AF966DD801CB6B988D4447FA884C03C76EA511B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 088a478375fedc0bd439b4d78888c00a5f72b09209fbf68af45a1a12fcca0608
MD5 aa5009255b54133c973989b032e67b11
SHA1 95b1fe98887d28c43e8273111418ccb4f061d650
SHA512 9bd20bc63820efd36cb8a593a93624718380bc18aa349623e37eb4374bd826e462d3542533270f7146041b0ac0f514f1b3ba76e72d55f7ba9966f3632b2b51a8
SSDEEP 192:vON56Db6QmiUyJxHBa+jLIOmYtmpRgVoU6:vON56uuHBa+HIOnFqU6
TLSH
T1C902E83579786CB79EA26E49F48737279FA4107BD9562F84DAD81F1C00D764C230A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 6e59fbda57be70fe5e6e279f96594669a76b08f6c46df941136fb0af57696d13
MD5 dcf89f5a99fa8a8d165c4ceb5450afc4
SHA1 27fdc2c68b001bc73f8220a1657012eb981a88d3
SHA512 cae9263201f8808422e41f4279c2b78ae7784e57dffd51a0e12003c3832890abef39a64a551dfb685e949cee6ec5909b7ee3c1bba4117af25f2858d1c341a9a7
SSDEEP 384:AZcIusN434ielGiEa+HIOnJa47fhvFA8BJt1ov9THT2ivkudoc:+uXJagIOJa47B680v9Dii8udT
TLSH
T101B25BB1D8681CE744E5E9C9A586E6172EB80137C58E5D1CE6F8BB3D309F8F81312826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0b3f260b71f0dc600b8c71ac7e384083551293801e76e2bbde55cb6c36b09e66
MD5 be7c082675f56bbcdbd408892e33b01b
SHA1 541c0305393ea40e5811fccd8c91bbdc911d1674
SHA512 f5aa137e8ac2eee5ece9b85007c310fcebee773ed303d024b382c7fa425c76570c6861102fb1459ecd91fccb96915bdef7f45ff162cd714917cf1c17683f11e2
SSDEEP 192:CONR6DbpQmiUydx+Ba+jLIOmYtmsa0e45NNzZq7U6:CONR6v0+Ba+HIOnJa4j6U6
TLSH
T1B112193669785C7B5EE2A988F4C736139FA95177DA8A7F80D5CC2F1C00DB59C130E826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 c630094633292892fb22ad4591c4a8fbdacacce4fd4685b5f3adddf619d9070e
MD5 155d1546e11d7084a83f11ca4fefcda5
SHA1 65d99f4d4473847841a464570f44a653704644c3
SHA512 4f7061e569fde8410f7309af5dc494e238d81368a77dbd70ed96310c8192ab545b00e1d64ed82006367688ac74f2e5319fb1c6d26813cb23f5402952c19654b7
TLSH
T18441E899B6EA2148B3B76F169BF6786E497F7D232E0A945D00110E4F0A67A40C871B37
MD5 SHA1 SHA512 TLSH

Submit Download

ImGui-Menu-MemeSense-main.zip.crdownload

Path C:\Users\Admin\Downloads\ImGui-Menu-MemeSense-main.zip.crdownload
Size 1.9MB
SHA256 0b3cccc9ff901d0614f68885b4e41c517e886587f85a93321d30bd609e721b1e
MD5 1cc7c78fde42d0e37d9221a881e02525
SHA1 c5fb3791abb3ab28ee8a9c36b4f89b775477bbca
SHA512 f1f7bafd095e475da2639825de0affc07c41f997211bbc9342df125636abd64bd3d10e8d309ed11a7c7803b85ddbe41e7a55ae65d2417775eb4e8f4f9cd80063
SSDEEP 49152:9HoIwSHd5+LJTpmEEZuJe/JdAW0D80s296k0gx:6sQedLT0DjEix
TLSH
T16C9533ED31E8FE92F93203B125704953AECA0199C79C1A7B51CA2847436B285AFDD35F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads